Freedom251 › User and Entity Behavior Analytics Software
VbtEngine UEBA
What VbtEngine UEBA is
VbtEngine UEBA analyzes user and entity behavior to surface anomalies and insider-threat signals, assigning risk scores to findings. It uses existing FortiGate VPN and SSH logs from fw_vpn_log and fw_ssh_log, with no new agent required. Its baseline covers 30 days and excludes the most recent 24 hours. The engine describes twelve anomaly types, including new users or source IPs, unusual hours, volume spikes, dormant-account reactivation, suspected account takeover, lateral movement and suspected brute force.
Related signals can be correlated: two findings that are each medium risk may combine into a high-risk result. Location filtering excludes internal, VPN, loopback, link-local, multicast and CGNAT addresses, and treats IPs within the same /24 as the same location. Heavy log scans run in a background worker while the main API reads a cache. UEBA data, deduplication and seven-day anomaly history are separated by tenant.
Sequence correlation can automatically open a SIEM case when a brute-force lockout is followed within an hour by specified UEBA anomalies. The wider platform lists LDAP/LDAPS Active Directory synchronization and integrations for Jira, ServiceNow, Slack, Teams, PagerDuty, Discord and generic JSON webhooks. It also lists administration controls with more than 70 atomic permissions across more than 25 domains, seven built-in roles, and live compliance assessments for CIS v8, ISO 27001, NIST CSF 2.0, KVKK, PCI-DSS, SOC 2 and 5651. The UEBA technical summary specifies on-prem deployment. VBT Yazılım A.Ş., established on 24 June 1993, offers platform support by email on business days, weekdays 09:00–18:00 Istanbul time (GMT+3).
Who it suits
VbtEngine UEBA suits security teams working with FortiGate VPN and SSH logs that want behavioral anomaly findings and risk scoring without adding a log agent. Its tenant separation and SIEM case automation may fit organizations managing multiple tenants and response workflows.
What it does well
- Uses existing FortiGate VPN and SSH logs without a new agent.
- Builds a 30-day baseline excluding the latest 24 hours.
- Correlates signals so combined medium-risk findings can escalate.
- Keeps UEBA data and anomaly history separate by tenant.
- Sequence correlation can automatically open a SIEM case.
What to know first
- Pricing is available on request.
- The page offers a demo request but gives no trial terms.
- The technical summary specifies on-prem deployment.
Limits
The product page offers a demo request but does not state trial terms. Pricing is on request.
Getting started
- Open the VbtEngine UEBA product page.
- Request a demo from the product page.
- Plan an on-prem deployment, as specified in the technical summary.
- Use the existing FortiGate VPN and SSH log sources.
- Contact platform support by email on business days if needed.
Verdict
Consider VbtEngine UEBA if you use its listed FortiGate VPN and SSH log sources and need tenant-separated behavioral findings with risk scoring. Its correlated signals and SIEM case automation are useful for response workflows. Request a demo and pricing details to assess fit, since the page does not state a price or trial terms.
Questions
How is VbtEngine UEBA priced?
Pricing is on request. The product page offers a demo request and does not state trial terms.
Where is it deployed?
The UEBA technical summary specifies on-prem deployment. The listed platforms are self-hosted and web.
Does it require a new agent?
No new agent is required for the listed FortiGate VPN and SSH log sources, fw_vpn_log and fw_ssh_log.
What integrations are listed?
The platform lists LDAP/LDAPS Active Directory synchronization, Jira, ServiceNow, Slack, Teams, PagerDuty, Discord and generic JSON webhooks. Sequence correlation can open a SIEM case after a brute-force lockout followed within an hour by specified UEBA anomalies.
Who makes VbtEngine?
VBT Yazılım A.Ş. is the maker. It says it was established on 24 June 1993 and lists an Istanbul address.
When is support available?
Platform support is offered by email on business days, weekdays 09:00–18:00 Istanbul time (GMT+3).
Facts from VbtEngine UEBA's own pages
- Access control
- The administration module defines more than 70 atomic permissions across more than 25 domains and includes seven built-in roles. · vbtengine.com, 1 Oct 2026
- Anomaly detection
- The engine produces twelve anomaly types, including new users, new source IPs, unusual hours, volume spikes, account takeover suspicion, lateral movement and suspected brute force. · vbtengine.com, 1 Oct 2026
- Baseline
- It builds a 30-day behavioral baseline that excludes the most recent 24 hours. · vbtengine.com, 30 Sept 2026
- Behavior baseline
- It builds a 30-day behavioral baseline while excluding the last 24 hours. · vbtengine.com, 1 Oct 2026
- Company
- VBT Yazılım A.Ş. was established on 24 June 1993 to provide software, hardware and information-technology consultancy services. · vbt.com.tr, 1 Oct 2026
- Compliance
- The compliance module supports live assessment frameworks including CIS v8, ISO 27001, NIST CSF 2.0, KVKK, PCI-DSS, SOC 2 and 5651. · vbtengine.com, 1 Oct 2026
- Connectors
- The platform provides LDAP/LDAPS Active Directory synchronization plus Jira, ServiceNow, Slack, Teams, PagerDuty, Discord and generic JSON webhook integrations. · vbtengine.com, 1 Oct 2026
- Deployment
- The technical summary lists deployment as on-prem. · vbtengine.com, 1 Oct 2026
- Detection
- The engine describes twelve anomaly types, including new source IP, unusual hour, dormant reactivation, suspected account takeover, lateral movement, and suspected brute force. · vbtengine.com, 30 Sept 2026
- Log sources
- The module uses existing FortiGate VPN and SSH logs, specifically fw_vpn_log and fw_ssh_log, without a new agent. · vbtengine.com, 1 Oct 2026
- Maker
- VBT Yazılım A.Ş. says it was established on 24 June 1993 and lists an Istanbul address. · vbt.com.tr, 30 Sept 2026
- Multi-tenancy
- A single scan buckets data per tenant, with separate anomaly history and tenant-specific slices. · vbtengine.com, 1 Oct 2026
- Noise filtering
- RFC1918, CGNAT, loopback and link-local addresses are discarded as location signals, and only public routable IPs count. · vbtengine.com, 1 Oct 2026
- Performance
- Heavy scans run in an isolated background worker so the main API process is not blocked. · vbtengine.com, 1 Oct 2026
- Pricing and access
- The UEBA page offers a demo request and does not state a price or trial terms. · vbtengine.com, 30 Sept 2026
- Processing
- Heavy log scans run in a background worker, while the main API reads a cache and does not scan fw_logs.db synchronously. · vbtengine.com, 30 Sept 2026
- Purpose
- UEBA learns user and entity behavior to surface anomalies and insider-threat signals with a risk score. · vbtengine.com, 1 Oct 2026
- Risk correlation
- One medium-risk signal combined with another can escalate into a high-risk finding. · vbtengine.com, 1 Oct 2026
- Risk scoring
- Certain signals can be correlated so that two individually medium-risk signals escalate into a high-risk finding. · vbtengine.com, 30 Sept 2026
- SIEM integration
- High-risk UEBA findings feed SIEM sequence correlation and can automatically open cases after specified brute-force-related anomalies. · vbtengine.com, 1 Oct 2026
- Support
- Technical support is available on weekdays from 09:00 to 18:00 Istanbul time (GMT+3). · vbtengine.com, 1 Oct 2026